Custom CA cert

I’m trying to connect to DigitalOcean-hosted postgres from linux box (also DO-hosted). While connecting from CLI using psql works fine using TLS, deno can’t connect, reporting:

Sending fatal alert BadCertificate
error: Uncaught (in promise) InvalidData: invalid certificate: UnknownIssuer
          this.#conn = await Deno.startTls(this.#conn, { hostname });
                       ^
    at processResponse (deno:core/core.js:212:11)
    at Object.jsonOpAsync (deno:core/core.js:230:12)
    at async Object.startTls (deno:runtime/js/40_tls.js:69:17)
    at async Connection.startup (https://deno.land/x/postgres@v0.11.2/connection/connection.ts:266:24)

I tried supplying DO cert file using --cert <file.pem> param, I tried installing the cert system-wide. I tried extracting the cert from Postgres server using openssl s_connect. No success. Can anyone help?

Using:

$ deno --version
deno 1.9.2 (release, x86_64-unknown-linux-gnu)
v8 9.1.269.5
typescript 4.2.2

[jfedyczak]

Maybe this will help someone. I put pgbouncer on the same machine between the app and the database, so connections from Deno to pgbouncer are unencrypted, but pgbouncer uses TLS to connect to real database server.

[cryptogohan]

Alright, ended up going way down the rabbit hole, added a cert option. Sadly something still goes wrong. Spent hours trying to make progress but no. Seems you’d need an intimate understanding of the connection negotiation between pg and Deno. Hopefully, some form of treat-unsafe-domain-as-safe flag lands soon, or someone writes or updates a driver to work with a passed cert file.